EHS Operations·9 min read
Incident Investigation: 5 Whys & PEEPO Field Guide
How to run incident investigations that prevent recurrence. The 5 Whys finds root cause, PEEPO finds blind spots, and BLS data shows 2.8M reasons it matters.
21 Apr 2026
Module · Core EHS
Permit to work the field actually runs
The full permit lifecycle (request, risk review, approval, issuance, acknowledgement, and closure) runs on a phone. QR-based access at the point of work, and a live heat map that flags overlapping permits before a conflict reaches the field.
Permit to work is the control that stands between a routine high-risk job and a fatality. Hot work, confined-space entry, working at height, energized electrical work, excavation, and lifting all depend on a permit being requested, reviewed, authorized, and acknowledged by the right people before the first tool is lifted. When that runs on paper boards and clipboards, the weak point is not the form. It is that no single person can hold every active permit in their head at once.
HaloEHS e-PTW digitizes the whole lifecycle and keeps it in the field, not the permit office. A worker requests a permit on a phone, the risk review and approvals route automatically to the competent people, and the issued permit is available at the point of work by scanning a QR code. Critically, the system sees every concurrent permit at once and flags the overlaps a paper board misses: hot work scheduled next to a fuel transfer, a lift over an occupied area, two crews isolating the same line.
Permit to Work Software (e-PTW) | HaloEHS: what you get
Six capabilities that turn permit to work from a paperwork burden into a working safety loop.
End-to-end permit lifecycle
Request, risk assessment, approval, issuance, worker acknowledgement, and closure run as one connected workflow. Every step is time-stamped and attributable, so a closed permit is a complete record, not a missing clipboard.
QR-based access at the point of work
Post a QR code at the work location. Anyone can scan it to see the active permit, its conditions, the isolations in force, and who authorized it, without hunting down the permit office or a paper copy.
Permit heat map and SIMOPS detection
A live heat map shows every active permit by location. The system flags simultaneous-operations conflicts (hot work near hydrocarbons, lifting over personnel, clashing isolations) before the permit is issued, not after the incident.
Isolation and LOTO verification
Lockout/tagout points are captured against the permit and verified on acknowledgement. Workers confirm the isolations that protect them are in place before work starts, and the evidence stays linked to the permit.
Mobile and offline-ready
The full request-to-close flow runs on any device, online or off. Permits captured in a basement, tank, or shielded area queue locally and sync the moment connectivity returns.
Expiry and re-validation alerts
Every permit carries a validity window. The system warns the holder and the issuer before a permit expires or needs re-validation for a new shift, so work never continues on a lapsed authorization.
Why paper permit systems fail at scale
A paper permit-to-work system works until two things happen at once. The single permit board in the control room becomes the only place the full picture exists, and it depends on one coordinator holding every active job in their head. On a busy multi-trade site that assumption breaks: a permit is issued for hot work in an area where another crew is draining a line, because no one cross-checked the two against each other. Add illegible handwriting, permits that walk off-site in a pocket, and closures that never get recorded, and the audit trail is gone exactly when an investigator needs it.
The consequences are not hypothetical. Permit-to-work breakdown is the textbook root cause of the worst process-safety disasters, and the pattern is consistent: the controls existed on paper but the system could not see that two activities should never have shared a zone. The failure is rarely a missing form. It is the absence of a single source of truth that holds every concurrent permit and flags the conflict before issuance.
How HaloEHS e-PTW works
The request starts in the field. A worker selects the permit type (hot work, confined space, height, electrical, excavation, lifting, or general), and the system presents the pre-canned checklist and risk assessment for that class, so the right controls are considered every time rather than left to memory.
Approvals route automatically to the competent people for that permit type and location. The risk review, any required atmospheric testing or isolation confirmation, and the final authorization are captured in sequence, each attributable to a named person with a timestamp. Once issued, the permit is live at the point of work through its QR code, and the workers covered acknowledge it before starting.
Closure is part of the record, not an afterthought. When the work finishes, the permit is closed out with its conditions confirmed and isolations removed in a controlled sequence. The complete lifecycle, covering who requested, who reviewed, who authorized, who acknowledged, and how it was closed, is retained as one auditable record per permit.
Permit overlap and simultaneous operations
The capability a paper board cannot match is seeing every permit at once. HaloEHS plots active and pending permits on a location heat map, so a supervisor can see at a glance where work is concentrated and where two activities are converging on the same zone.
Simultaneous-operations (SIMOPS) conflict detection runs before issuance. When a requested permit would put hot work near a fuel or oxygen source, a lift over an occupied area, or two crews isolating overlapping equipment, the system flags the clash and holds issuance until someone accountable resolves it. This is the difference between catching a conflict on a screen and discovering it as an incident.
Choosing the right permit type and authorization level
Not every high-risk task needs the same permit, and treating them identically makes a program either bureaucratic or unsafe. Map permit class to the hazard, and authorization level to the consequence.
Hot work (welding, cutting, grinding near combustibles) follows OSHA 1910.252 and NFPA 51B: a fire watch, atmospheric testing where flammables may be present, and a defined cooldown period. Confined-space entry is governed by OSHA 1910.146, which makes a permit mandatory for any permit-required space, with atmospheric testing, an attendant, and rescue provisions named before entry. Energized electrical work follows NFPA 70E and OSHA Subpart S, requiring an energized-work permit and a justification for why de-energizing is not feasible. Working at height, excavation, and lifting each carry their own pre-conditions.
Set authorization by consequence tier. Tier 1 (low-energy, single-trade, routine) can be authorized by a competent supervisor. Tier 2 (hot work, work at height, single-crew confined space) needs a permit issuer independent of the work crew, authorizing after a documented risk review. Tier 3 (SIMOPS, multi-trade confined space, energized high-voltage, or any job whose controls depend on another permit) escalates to the area authority who can see every concurrent permit at once. HaloEHS routes each permit to the authorization level its class and risk score demand and blocks issuance while a Tier 3 conflict is unresolved. The control that prevents the most serious events, with Piper Alpha the textbook permit-to-work failure, is exactly this: never issuing a permit whose hazards overlap another without someone accountable seeing both.
Permit to Work FAQ
An electronic permit to work is the digital version of the paper permit system that authorizes high-risk work: hot work, confined-space entry, working at height, energized electrical work, excavation, and lifting. Instead of a clipboard and a control-room board, the request, risk assessment, approvals, worker acknowledgement, and closure all run in software, each step attributable to a named person with a timestamp. The decisive advantage over paper is not speed; it is that the system holds every active permit in one place and can check a new request against all of them. HaloEHS runs the full lifecycle on mobile and surfaces conflicts between concurrent permits before any of them is issued.
HaloEHS ships pre-canned checklists and risk assessments for the common high-risk classes: hot work, confined-space entry, working at height, energized electrical work and lockout/tagout, excavation, and lifting operations, plus a configurable general work permit. Each type presents the controls appropriate to that hazard (a fire watch and atmospheric testing for hot work, an attendant and rescue plan for confined space, isolation verification for electrical) so the right preconditions are enforced rather than left to memory. Enterprise and on-premises deployments can customize the checklists and approval routing to match a site-specific permit procedure, so the digital permit mirrors the documented standard your auditors expect.
Each issued permit has a QR code that can be posted at the work location. Anyone on site, whether a worker, a supervisor, or a visiting inspector, scans it with a phone to pull up the active permit: its conditions, the isolations in force, the validity window, and who authorized it. This removes the recurring weakness of paper permits, where the only authoritative copy is on a board somewhere else or folded in a pocket. It also means an area authority can walk a site and verify in seconds that the work happening in front of them matches an active, valid permit, rather than taking it on trust.
SIMOPS stands for simultaneous operations: two or more activities running close enough in space and time that one can endanger the other. The classic cases are hot work near a hydrocarbon or oxygen source, a lift over an occupied work area, and two crews isolating overlapping equipment. HaloEHS plots every active and pending permit on a location heat map and checks each new request against the others before issuance. When it detects an overlap that creates a hazard, it flags the conflict and holds the permit until someone accountable resolves it. This is the failure mode paper permit boards miss most often, because no single coordinator is holding every active permit in their head at once.
Yes. Lockout/tagout and isolation points are captured against the permit and confirmed at acknowledgement, so the protections a worker depends on are verified before work starts and stay linked to the permit record. Because every module shares one data layer, a permit that is breached or involved in an event can be escalated into a full incident investigation with the permit attached as evidence, and permit compliance becomes auditable directly from the Audit module. The result is a connected chain (authorization, the controls in force, what actually happened, and the corrective action) rather than a permit log that lives apart from the rest of the safety system.
Yes. The full request-to-closure flow runs on any phone or tablet, and because HaloEHS is a Progressive Web App it works without connectivity. This matters because high-risk work often happens exactly where coverage is worst: inside tanks and vessels, in basements and deep excavations, in shielded plant areas. A worker can request, acknowledge, or close a permit offline; the action queues locally and syncs automatically when the device reconnects. For on-premises and private-cloud deployments the same offline capability syncs to your internal server when the device rejoins your network, so the permit record stays inside your own infrastructure.
Related reading
EHS Operations·9 min read
Building a Near-Miss Reporting Program That Workers Use
Near-misses outnumber major injuries 300 to 1 (Heinrich, 1931). The reporting program that captures them prevents the next incident. Here is how to build one.
11 May 2026
Safety Leadership·7 min read
Why EHS Software Matters: The Real Cost of Paper
Spreadsheet-driven EHS programs miss patterns and fail audits. With US workplace injuries costing $58.5B/yr, the upgrade case is data-driven.
25 Apr 2026
Other modules
Module
Audit Management
Plan, execute, and close EHS audits collaboratively. Multiple auditors work at once, external auditors get time-bound access, and findings trigger NCRs and CAPAs in one click.
Learn more
Module
Incident Management
From first report to verified closure. AI-generated titles, 5 Whys and PEEPO investigation, CAPA generation, and recurrence detection across history.
Learn more
Module
Observation
Empower every worker to report hazards in seconds. AI auto-classifies and routes observations for review, with anonymous reporting built in.
Learn more